ci: batch dependabot updates monthly and add job timeouts

[leynier]

Summary

Reduce GitHub Actions minutes spent on Dependabot version updates and bound runaway jobs.

• .github/dependabot.yml (pip, default branch): daily becomes monthly, adds cooldown.default-days: 7, and groups all version updates into one monthly-batch PR. This mirrors the config already used in educup-server and educup-automations.
• timeout-minutes added to every job: CI 30, analyze (CodeQL) 30, Docs 60 (GitHub Pages deploy), Publish 60 (release upload).

Security updates are unchanged. groups uses applies-to: version-updates, so security PRs still open individually.

Expected savings

This repo had 18 Dependabot runs in September. Each Dependabot PR against main also triggers CI and CodeQL. With monthly grouped updates, that drops to roughly one grouped PR per month. Across the three repos in this change set (youtube-extractor, educup-youtube-parser-api, uvm), the combined saving is estimated at ~150–200 Actions minutes/month.

Validation

• All changed files parse with PyYAML.
• dependabot.yml validates against the SchemaStore dependabot-2.0 JSON schema, which includes cooldown and groups.applies-to.
• actionlint (Docker rhysd/actionlint:latest) shows no new findings compared with the base branch. The 11 existing findings are outdated action versions (for example actions/checkout@v2 and github/codeql-action@v1) and are out of scope here.

Risks

• Non-security dependency bumps arrive up to a month later, as one larger PR. A failing grouped PR can hide which package broke the build.
• A 30- or 60-minute timeout only cancels jobs that hang. Current runs finish in a few minutes.